We ran the Kujur / Khanafseh / Pervan detection framework against every Kern-County ADS-B detection we hold. Case-folded hex duplicates (uppercase-vs-lowercase of the same ICAO 24-bit address) have been removed as a pipeline artifact. What remains are physical-domain signatures the transponder itself cannot explain.
An earlier version of this page treated aircraft that appeared under both an uppercase and a lowercase spelling of the same ICAO 24-bit hex (e.g. acae33 vs ACAE33) as evidence of deliberate case-folded identity spoofing. On re-audit, that split was traced to our own case-normalization pipeline, not to the broadcast. We pulled the uppercase-vs-lowercase comparison, purged the artifact from the anomaly feed, and republished the physics-only findings below. That is the point of an open database.
The IIT paper proposes a snapshot position-domain innovation monitor: compare each received GNSS/ADS-B position to what an INS/Kalman filter would predict. We implement the equivalent in SQL against every Kern detection in our warehouse. All six of the remaining tests operate purely on broadcast physics — none of them depend on the case of the hex string.
| Tail | Hex | Registered owner | Violations | Alt range (ft) |
|---|---|---|---|---|
| N1668R | A10B78 | EDWARDS AIR FORCE BASE AERO CLUB | 157 | 375 → 8,900 |
| N341C | A3C137 | BREAKING WIND AVIATION LLC | 85 | 200 → 2,600 |
| N8410M | AB85F4 | JR IMAGING LOGISTICS INC | 71 | 1,750 → 4,675 |
| N394TG | A49355 | GREENHILL THOMAS V | 67 | 4,100 → 11,750 |
| N277LM | A2C183 | REGISTRATION PENDING | 27 | 7,525 → 9,500 |
| N690RA | A92C2E | TURBO JOE LEASING LLC | 20 | 6,050 → 6,725 |
| 25-1003 | AF3B4D | UNKNOWN OWNER | 9 | 2,300 → 25,000 |
| B-16715 | 8990DD | UNKNOWN OWNER | 6 | 33,000 → 36,825 |
| 65-10437 | AE00CB | UNKNOWN OWNER | 4 | 15,350 → 21,825 |
| N281PR | A2D307 | SCALED COMPOSITES LLC | 4 | 2,675 → 2,675 |
Navigation Integrity Category is the transponder's own declaration of how much ATC should trust the position it just broadcast. Value 0 means "unknown / unusable." Aircraft in this list broadcast NIC = 0 while their velocity vector said they were moving faster than 50 kts — a state the IIT paper identifies as an indicator of a spoofed or fabricated position solution.
| Tail | Hex | Registered owner | NIC=0 pings | Alt range (ft) |
|---|---|---|---|---|
| — | 000017 | UNKNOWN OWNER | 7,012 | -500 → 37,975 |
| N4691R | A5BD95 | BEST EQUIPMENT LEASING LLC | 4,971 | 300 → 10,200 |
| N7051R | A969AC | BEST EQUIPMENT LEASING LLC | 3,477 | 200 → 8,600 |
| N73977 | A9EFE7 | BFL AVIATION LLC | 3,370 | 250 → 10,400 |
| N4334J | A53130 | BEST EQUIPMENT LEASING LLC | 2,897 | 250 → 8,500 |
| N124WD | A06486 | KCSI AERIAL PATROL INC | 2,514 | 375 → 10,000 |
| N417DM | A4EE78 | KCSI AERIAL PATROL INC | 2,100 | 375 → 9,700 |
| N2SG | A18EE8 | KCSI AERIAL PATROL | 2,047 | 100 → 8,600 |
| N720AC | A9A38F | KCSI AERIAL PATROL INC | 1,954 | 500 → 4,800 |
| N20039 | A194E6 | KCSI AERIAL PATROL INC | 1,857 | 500 → 10,700 |
An aircraft cannot fly underground. When a transponder broadcasts a negative altitude, the ATC and ADS-B ecosystem accepts it anyway. That is the exact failure mode the IIT paper predicts a GNSS spoofer would exploit: inject a fabricated altitude into the position solution, and every downstream consumer treats it as ground truth.
| Tail | Hex | Registered owner | Sub-surface pings | Deepest (ft) |
|---|---|---|---|---|
| — | 09116D | UNKNOWN OWNER | 84 | -1,100 |
| N193TH | A17501 | WINGSLEASING LLC | 15 | -1,875 |
| N237TH | A22432 | WINGSLEASING LLC | 11 | -1,500 |
| N916GW | ACADA0 | 9K AIR LLC | 11 | -1,500 |
| N21714 | A1D61B | AERO EQUITIES LLC | 10 | -1,475 |
| N436CA | A5399B | WINGSLEASING LLC | 9 | -2,550 |
| N806NA | AAF954 | NASA NEIL A ARMSTRONG FLIGHT RESEARCH CENTER | 9 | -1,000 |
| N916BQ | ACAD1D | 9K AIR LLC | 7 | -2,500 |
| N194TH | A178B8 | WINGSLEASING LLC | 7 | -1,850 |
| N473CA | A5CC72 | WINGSLEASING LLC | 6 | -2,650 |
| Anomaly in our data | IIT paper explanation | Physical reality |
|---|---|---|
| Negative altitude (sub-surface) | Spoofer or transponder fault injects fabricated GNSS altitude | Aircraft cannot fly underground |
| 0.1 kts speed with position updates | Spoofer reports minimal position changes | Fixed-wing stall speed is well above 30 kts |
| Position teleports > 3 nm in < 5 min | Spoofer updates false trajectory discontinuously | Real aircraft move smoothly |
| Frozen position while velocity > 50 kts | Spoofer reports speed but doesn't update position | Physically impossible |
| NIC = 0 while moving | Transponder disclaims its own position-integrity claim | Real avionics don't self-invalidate mid-flight |
| § 91.227 violation flag | FAA-defined transponder non-compliance detected in the broadcast | The rule the FAA itself wrote to prevent this |
Citation: Kujur, B., Khanafseh, S., Pervan, B. — "Detecting GNSS spoofing of ADS-B equipped aircraft using INS" — Illinois Institute of Technology, 10th ICG Workshop, Vienna, December 2022.